Facebook has admitted to accessing and storing the email contacts of as many as 1.5 million of its users without their consent. Business Insider reports that between May 2016 and last month, the social media platform asked some of its new users to verify their email address by providing the password to their email account. After doing so, the users’ contacts would be automatically imported, without any option for the user to opt out.

Responding to the report, a Facebook spokesperson told Business Insider that email contacts were “unintentionally uploaded” as part of the process. They said that these contacts had never been shared with anyone, and that the company is now deleting the contacts that were uploaded. Facebook also claims to have fixed the “underlying issue” that led to the problem.

“Need help?”

Email verification is a standard practice for online services, but Facebook handled it in a very different way. Usually, when you sign up to a new service you’re asked to provide an email address, which then receives an email with a link in it that you have to manually click in order to verify that the email account belongs to you.

Instead, what Facebook did was to have users verify that they owned an email account by handing over their password to Facebook. “To continue using Facebook, you’ll need to confirm your email address” read the page asking for a user’s email password.

Users didn’t technically have to go through this process, but The Daily Beast notes that the service’s more traditional verification options were hidden behind a nondescript “Need help?” link located below the email password box. Users could also verify their account with a code sent to their phone.

Prior to May 2016, Facebook would still upload a user’s contacts if they provided their email account password. However, that month, Facebook deleted the message that informed users that this upload was going to take place, but didn’t stop the upload from happening.